3 ms·
> its possible to encrypt with the private key and decrypt with the public key Isn't it just signing/verifying? I.e. "encryption" with a private key is how RSA
by jakobdabo 4y ago
> its possible to encrypt with the private key and decrypt with the public key
Isn't it just signing/verifying? I.e. "encryption" with a private key is how RSA is being used to sign, and "decryption" with a public key - used to verify the signature.
- jpnc 4y agoI thought so too. Encrypt the hash with private key -> decrypt with public key and check the hash.
- FujiApple 4y agoThis could well be it, though if the plaintext isn’t sent (unclear from the article if it is, I think not?) then all the client can really do is decrypt with public key and check that the output appears well formed, which may be good enough. It would seem odd, however, that client -> server is encrypted but unsigned whereas server -> client is signed but unencrypted. My guess, for what it’s worth, is that somebody at the company insisted that all comes must be encrypted and so they cobbled this together along with the obfuscation of the public key the author describes.